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AMENDMENTS TO THE CLAIMS 



1 . (Currently Amended) A computer-implemented method for adaptively filtering URL 
messages routed across a network : . ±.- : i :: - :.L ; ...d...'..i:.: ^ ^ - s " ^ ' 

on attrib ; - 
messaj j ^gejee^^ the method comprising: 

receiving a fii M 

maintaining a frequency for ea€-h--i-n-s-ta-fK:-e--ef - at he first URL component, 
wherein the frequency is a function of a number of occurrences with which 
messages containing athe first URL component was- were rejected hy - a - ra i e -and a 
number of occurrences with which vs ^ ^ descendants of the first 

URL component were rejected with the rule ; 

regenerating an exception rule for the fir-4 s n =e< URL component and its 
descendants responsive to the frequency of the first URL coUij> v > . • s v w 

- ^ <- -- s sN i st URL com po: 

v! 1 i t - v- ! : v.; * ! ■ Nc cond message to pass . 

2. (Currently Amended) The method of claim 1, wherein the set of constraints 

s Meeting a URL component with a frequency exceeding a threshold and 
having no children with a frequency above the threshold. 

3. (Currently Amended) The method of claim 1, wherein the set of constraints is 
selecting a LTRL component w ith requires a frequency exceeding a threshold. 

4. (Original) The method of claim 1, further comprising applying the exception rule to 
determine whether to allow the selected URL component and its descendants. 
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5. (Original) The method of claim 2, wherein the threshold is a product of a total 
number of URL messages over a time interval and a percentage of the messages that 
should be allowed. 

6. (Original) The method of claim 1 , wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the selected URL component. 

7. (Original) The method of claim 1 , wherein the frequency is a direct count of the 
occurrences of the URL component. 

8. (Original) The method of claim 1, wherein the frequency is a weighted count of the 
occurrences of the URL component. 

9. (Currently Amended) A computer-implemented method for adaptively filtering 
URL messages routed across a network by..ge?ic! dry; > > rules oju on rules 
based on attributes of URLs within messages previously received and rcjccted y-the-URL- 
messages rejected based on a set of rules , the method comprising: 

receiving a plurality oF messages, each message specifying a first URL 
component; 

rejecting the plurality of messages: 

storing rejected URLs in a trie structure, wherein each node in the trie 
structure is associated with a URL component; 

maintaining a frequency for each node associated with a URL component, 
wherein the frequency is a function of a number of occurrences with which a URL 
component associated with a node was - were rejected w-ith-a-mte-and a number of 
occurrences with which descendants of the URL component were rejected with 

seteeti - ng - a - Bode --- ^ 

generating an exception rule for the selected anode associated with the 
first URL component and its descendants responsive to the frequency of the first 
URL, component satisfying a set of constraints:? 
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receiving a message specify: ig | [ R cement; and 
allowing the message to pass. 



10. (Original) The method of claim 9, further comprising applying the exception rule to 
determine whether to allow the selected node and its descendants. 



1 1 . (Currently Amended) The method of claim 9, wherein the set of constraints is 
-equires a number of occurrences exceeding a threshold. 



12. ((Currently Amended) The method of claim 9, wherein the set of constraints is 
se - l - ee t i - ng - a - node - w i l l i requires a number of occurrences exceeding a threshold and having 
no children with a number of occurrences above the threshold. 



13. (Original) The method of claim 1 1 , wherein the threshold is a product of a total 
number of URL messages over a time interval and a percentage of the messages that 
should be allowed to pass. 



14. (Original) The method of claim 9, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the selected URL component. 

15. (Original) The method of claim 9, wherein the frequency is a direct count of a 
number of occurrences of the URL component. 

16. (Original) The method of claim 9, wherein the frequency is a weighted count of a 
number of occurrences of the URL component. 

17. (Currently Amended) A system for adaptively filtering URL messages routed across 
a network, by generating exception rules to rejection rules based on attributes of URLs 
within messa ges p.iv-, iously received, and xejectgd tbe- URL messages rejected - ba s- ed - ea - a 
■ s e t -- o - f - ru le s , the system comprising: 

a learning engine adapted to perform the steps of: 
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storing rejected URLs in a trie structure, wherein each node in the trie 
structure is associated with a URL component; 

maintaining a frequenc y for eac h node associated with a URL, component, 
wherein th e frequency - a ^ . , 
which a URL component associated with a node were rejected and a 
>:; : n:;v> of ;k\;:; ••.••k ^ i;h ^\ h;ch descend::;;;--- >u i h o I Ki UHnp^oncnj 
were rejected, and 

selecting a node according to a set of constraints; and 
generating an exception rule for t^he-selee-ted- a first node and its 
descendants, responsive to the frequency of the URL component 
associated with the first node satisfying a set of constraints ; and 

a filter configured to apply the exception rule to determine whether to allow the 

sc l ented - first node and its descendants. 

18. (Cancelled) 

19. (Currently Amended) The system of claim 18, wherein the set of constraints is 
sel:eet4ttg--a-f;0d^ v • i number of occurrences exceeding a threshold and having 
no children with a number of occurrences above the threshold. 

20. (Currently Amended) The system of claim 1 8, wherein the set of constraints 

requ»rc.sf H".H t 4 e e-tiBg"a-fied e -v v ->th a frequency exceeding a threshold. 

21. (Original) The system of claim 19, wherein the threshold is a product of a total 
number of URL messages over a time interval and a percentage of the messages that 
should be allowed. 

22. (Original) The system of claim 17, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the selected node. 
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23. (Original) The system of claim 18, wherein the frequency is a direct count of the 
number of occurrences of the URL component. 

24. (Original) The system of claim 18, wherein the frequency is a weighted count of the 
number of occurrences of the URL component. 

25. (Currently Amended) A computer program product comprising: a computer- 
readable medium having computer program code embodied therein for adaptively 
filtering URL messages routed across a network by generating exception rules to 
rejection rules based on attributes of URLs within messages previousl y received and 
rejeeted r - theURL m€Ssag the computer program code 
adapted to: 

store rejected URLs in a trie structure, wherein each node in the trie structure is 
associated with a URL component and each node associated with a URL component 
maintains a frequency, wherein the frequency is a function of a number of occurrences 
with which a URL component associated with a node was- were r ejecte d by a rul e and a 
number of occurrences with which descendants of the URL component were re feeted 
with th e rul e; s e l e ct a nod e according to a s e t of eefth-H*w : fe-.--and generate an exception 
rule for the-seteete d a first node and its descendants responsive to the frequency of the a 
URL com ponent associated with the first node satisfying a set of constraints. 

26. (Currently Amended) The computer program product of claim 25, wherein each node 
associated with a URL component maintains a frequency, wherein the frequency is a 
function of a number of occurrences with which a URL component associated with a 
node was rejected-by-a-mle and a number of occurrences with which descendants of the 
URL component were rejected with the rule . 

27. (Currently Amended) The computer program product of claim 26, wherein the set of 
constraints is--s e l e - et i ng -- a -- aed - e --v v - U - m gu\ i I requency exceeding a threshold and having 
no children with a frequency above the threshold. 
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28. (Currently Amended) The computer program product of claim 26, wherein the set of 
constraints is-seleetmg-^rHed^-w ^ reguires a frequency exceeding a threshold. 

29. (Original) The computer program product of claim 25, wherein the computer program 
code is further adapted to apply the exception rule to determine whether to allow the 
selected node and its descendants to pass. 

30. (Original) The computer program product of claim 27, wherein the threshold is a 
product of a total number of URL messages over a time interval and a percentage of the 
messages that should be allowed to pass. 

31. (Original) The computer program product of claim 25, wherein the exception rule is 
generated by inferencing a scalar data type of the descendants of the selected node. 

32. (Currently Amended) A computer-implemented method for adaptively filtering URL 
messages routed across a network-; by generating exception rules to rejection rules based 

soj I RK within messages previously received and rejected the URL 
messages rejected based on a set of rules , the method comprising: 

storing rejected URLs in a trie structure, wherein each node in the trie structure is 
associated with a URL components and each node associated with a URL component 
maintains a frequency, wherein the frequency is a function of a number of occurrences 

*\ Mil !i ■ 1 H.i .OippoiK'ni <! SOt \ :\\) '\ sib d pod,' \>4S \ OJ , i .<!. 

sel e etffig - &"fted e "ift4fa & 4^ and 
generating an exception rule for th e s e l e cte d a first node and its descendants , responsive to 
the frequency of the URL component associated with the first node satisfying a set of 
constraints . 

33. (Original) The method of claim 32, further comprising maintaining a frequency for 
each node associated with a URL component, wherein the frequency is a function of a 
number of occurrences with which a URL component associated with a node was 
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rejected by a rule and a number of occurrences with which descendants of the URL 
component were rejected -with-th-e-iH-tle . 

34. (Original) The method of claim 32, further comprising applying the exception rule to 
determine whether to allow the selected node and its descendants. 

35. (Currently Amended) The method of claim 32, wherein the set of constraints is 
selecting a node wiihrc quires a number of occurrences exceeding a threshold. 

36. (Currently Amended) The method of claim 32, wherein the set of constraints is 
se - l - e€ t i - ng - a -- node - w i lh requires a number of occurrences exceeding a threshold and having 
no children with a number of occurrences above the threshold. 

37. (Original) The method of claim 35, wherein the threshold is a product of a total 
number of URL messages over a time interval and a percentage of the messages that 
should be allowed. 

38. (Original) The method of claim 32, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the selected URL component. 

39. (Original) The method of claim 33, wherein the frequency is a direct count of the 
number of occurrences of the URL component associated with the selected node. 

40. (Original) The method of claim 33, wherein the frequency is a weighted count of the 
number of occurrences of the URL component associated with the selected node. 
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